Windows Message Queuing EUVD-2026-99791

Exploitation requires the Windows Message Queuing (MSMQ) feature to be installed and the Queue Manager service running - MSMQ is an optional component that is NOT enabled by default, which materially limits the real-world attack surface. Per CVSS PR:L, the attacker must already be an authenticated low-privileged local user on the host (AV:L), so there is no remote or unauthenticated path and no user interaction is needed (UI:N). Impact is limited to information disclosure (C:H, I:N, A:N); the flaw does not by itself grant code execution or privilege escalation.

This is a moderate, low-priority issue despite being a memory-safety flaw in a Microsoft Windows component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent: exploitation is purely local (AV:L), requires an already-authenticated low-privilege user (PR:L), and yields only information disclosure (C:H, with I:N/A:N). CISA's SSVC framework reinforces low urgency - Exploitation: none, Automatable: no, Technical Impact: partial - which aligns with the local-only, confidentiality-only nature of the bug and with the absence of any KEV listing. No EPSS score was provided in the input, and no public exploit is indicated. There is no conflict between the signals: all sources (CVSS local vector, SSVC 'none'/'no', no KEV, no POC) point consistently to a flaw that is a defense-in-depth fix rather than an actively-threatened vector. The main value it offers an attacker is as a local information-disclosure primitive (e.g., leaking memory to bypass ASLR) that could be chained with a separate privilege-escalation bug, but on its own it is not a mass-exploitation risk.

A low-privileged local user who already has code execution on a Windows host running the Message Queuing (MSMQ) service sends specially crafted data to the Queue Manager, triggering a type-confusion condition that causes the service to return memory contents it should not expose. The attacker reads disclosed in-process data (such as pointers or secrets) to aid a follow-on exploit. No public exploit code is identified at time of analysis, and exploitation requires local authenticated access plus the MSMQ feature being installed.